This critical out-of-bounds write vulnerability in Samsung mobile devices is currently being exploited in the wild and poses a severe risk of arbitrary code execution.

The flaw exists in the libimagecodec.quram.so library, where an out-of-bounds write condition allows an unauthenticated remote attacker to execute arbitrary code on the target device. Successful exploitation typically requires user interaction to trigger the processing of a malicious image file.

The vulnerability carries a CVSS score of 9.5, reflecting its critical nature. Successful exploitation allows for full system compromise, enabling attackers to gain unauthorized access to sensitive user data, install persistent malware, or disrupt device functionality. Given the widespread use of these devices in corporate and personal environments, this vulnerability presents a significant risk to data confidentiality and integrity.

Immediate Action: Update all affected Samsung mobile devices to the SMR Sep-2025 Release or later, as specified in the Samsung security advisory.

Proactive Monitoring: Security teams should monitor mobile device management (MDM) logs for unusual application crashes or unauthorized process executions associated with the libimagecodec library.

Compensating Controls: While no direct virtual patch exists for this hardware-level vulnerability, users should exercise extreme caution when opening files or links from untrusted sources to minimize the risk of user interaction.

Public Exploit Available: Yes, this vulnerability is confirmed as actively exploited in the wild.

Due to the critical severity of this vulnerability and confirmed active exploitation, organizations must prioritize the deployment of the SMR Sep-2025 firmware update. Failure to apply this patch leaves devices vulnerable to remote code execution and potential total system compromise. IT administrators should verify that all managed devices have successfully applied the required security update immediately.